Behzad Akbari Spring In the Name of the Most High

 Approaches to Message Authentication  Secure Hash Functions and HMAC  Public-Key Cryptography Principles  Public-Key Cryptography Algorithms  Digital Signatures  Key Management 2

 Requirements: must be able to verify that: 1. Message came from apparent source or author, 2. Contents have not been altered, 3. Sometimes, it was sent at a certain time or sequence.  Protection against active attack (falsification of data and transactions) 3

 Authentication Using Conventional Encryption ◦ Only the sender and receiver should share a key  Message Authentication without Message Encryption ◦ An authentication tag is generated and appended to each message  Message Authentication Code ◦ Calculate the MAC as a function of the message and the key. MAC = F(K, M) 4

5

6 One-way HASH function

 Ideally we would like to avoid encryption, because: ◦ Encryption software is slow ◦ Encryption hardware costs aren’t cheap ◦ Hardware optimized toward large data sizes ◦ Algorithms covered by patents ◦ Algorithms subject to export control 7

 Secret value is added before the hash and removed before transmission. 8

 Purpose of the HASH function is to produce a ”fingerprint.  Properties of a HASH function H : 1.H can be applied to a block of data at any size 2.H produces a fixed length output 3.H(x) is easy to compute for any given x. 4.For any given value h, it is computationally infeasible to find x such that H(x) = h 5.For any given block x, it is computationally infeasible to find with H(y) = H(x). 6.It is computationally infeasible to find any pair (x, y) such that H(x) = H(y) 9

 One-bit circular shift on the hash value after each block is processed would improve 10

11

12

13 SHA-1MD5RIPEMD-160 Digest length160 bits128 bits160 bits Basic unit of processing 512 bits Number of steps80 (4 rounds of 20) 64 (4 rounds of 16) 160 (5 paired rounds of 16) Maximum message size bits

 Use a MAC derived from a cryptographic hash code, such as SHA-1.  Motivations: ◦ Cryptographic hash functions executes faster in software than encryptoin algorithms such as DES ◦ Library code for cryptographic hash functions is widely available ◦ No export restrictions from the US 14

15

 The use of two keys has consequences in: key distribution, confidentiality and authentication.  The scheme has six ingredients (see Figure 3.7) ◦ Plaintext ◦ Encryption algorithm ◦ Public and private key ◦ Ciphertext ◦ Decryption algorithm 16

17

18

 Three categories: ◦ Encryption/decryption: The sender encrypts a message with the recipient’s public key. ◦ Digital signature: The sender ”signs” a message with its private key. ◦ Key echange: Two sides cooperate two exhange a session key. 19

1. Computationally easy for a party B to generate a pair (public key KU b, private key KR b ) 2. Easy for sender to generate ciphertext: 3. Easy for the receiver to decrypt ciphertect using private key: 20

4. Computationally infeasible to determine private key (KR b ) knowing public key (KU b ) 5. Computationally infeasible to recover message M, knowing KU b and ciphertext C 6. Either of the two keys can be used for encryption, with the other used for decryption: 21

 RSA and Diffie-Hellman  RSA - Ron Rives, Adi Shamir and Len Adleman at MIT, in ◦ RSA is a block cipher ◦ The most widely implemented  Diffie-Hellman ◦ Exchange a secret key securely ◦ Compute discrete logarithms 22

1. Select p,q p and q both prime 2. Calculate n = p x q 3. Calculate 4. Select integer e 5. Calculate d 6. Public KeyKU = {e,n} 7. Private keyKR = {d,n} 23

 Plaintext:M<n  Ciphertext:C = M e (mod n) 24

 Ciphertext:C  Plaintext:M = C d (mod n) 25

26 Bob chooses p=5, q=7. Then n=35, z=(p-1) (q-1)=24. e=5 (so e, z relatively prime). (d=29 (so ed-1 exactly divisible by z. letter m m e c = m mod n e l c m = c mod n d c d letter l encrypt: decrypt:

27

28 m = (m mod n) e mod n d (m mod n) e mod n = m mod n d ed Useful number theory result: If p, q prime and n = pq, then: x mod n = x mod n yy mod (p-1)(q-1) = m mod n ed mod (p-1)(q-1) = m mod n 1 = m (using number theory result above) (since we chose ed to be divisible by (p-1)(q-1) with remainder 1 )

29

 Alice and Bob agree to use a prime number p=23 and base g=5.  Alice chooses a secret integer a=6, then sends Bob (g a mod p) ◦ 5 6 mod 23 = 8.  Bob chooses a secret integer b=15, then sends Alice (g b mod p) ◦ 5 15 mod 23 = 19.  Alice computes (g b mod p) a mod p ◦ 19 6 mod 23 = 2.  Bob computes (g a mod p) b mod p ◦ 8 15 mod 23 = base g : primitive root of p A primitive root of p is a number r such that any integer a between 1 and p-1 can be expressed by a=r^k mod p, with k a nonnegative integer smaller that p-1.

 Digital Signature Standard (DSS) ◦ Makes use of the SHA-1 ◦ Not for encryption or key echange  Elliptic-Curve Cryptography (ECC) ◦ Good for smaller block size ◦ Low confidence level, compared with RSA ◦ Very complex 31

32 m s (shared secret) (message) H(. ) H(m+s) public Internet append m H(m+s) s compare m H(m+s) H(. ) H(m+s) (shared secret)

 MD5 hash function widely used (RFC 1321) ◦ computes 128-bit MAC in 4-step process. ◦ arbitrary 128-bit string x, appears difficult to construct msg m whose MD5 hash is equal to x  recent (2005) attacks on MD5  SHA-1 is also used ◦ US standard [ NIST, FIPS PUB 180-1] ◦ 160-bit MAC 33

cryptographic technique analogous to hand- written signatures.  sender (Bob) digitally signs document, establishing he is document owner/creator.  verifiable, nonforgeable: recipient (Alice) can prove to someone that Bob, and no one else (including Alice), must have signed document 34

simple digital signature for message m:  Bob “signs” m by encrypting with his private key K B, creating “signed” message, K B (m) Dear Alice Oh, how I have missed you. I think of you all the time! …(blah blah blah) Bob Bob’s message, m public key encryption algorithm Bob’s private key K B - Bob’s message, m, signed (encrypted) with his private key K B - (m)

 suppose Alice receives msg m, digital signature K B (m)  Alice verifies m signed by Bob by applying Bob’s public key K B to K B (m) then checks K B (K B (m) ) = m.  if K B (K B (m) ) = m, whoever signed m must have used Bob’s private key. 36 Alice thus verifies that: üBob signed m. üNo one else signed m. üBob signed m and not m’. non-repudiation: Alice can take m, and signature K B (m) to court and prove that Bob signed m

Alice verifies signature and integrity of digitally signed message: 37 large message m H: hash function H(m) digital signature (encrypt) Bob’s private key K B - + Bob sends digitally signed message: K B (H(m)) - encrypted msg digest K B (H(m)) - encrypted msg digest large message m H: hash function H(m) digital signature (decrypt) H(m) Bob’s public key K B + equal ? Digital signature = signed MAC

public key problem:  When Alice obtains Bob’s public key (from web site, , diskette), how does she know it is Bob’s public key, not Trudy’s? solution:  trusted certification authority (CA) 38

 Certification Authority (CA): binds public key to particular entity, E.  E registers its public key with CA. ◦ E provides “proof of identity” to CA. ◦ CA creates certificate binding E to its public key. ◦ certificate containing E’s public key digitally signed by CA: CA says “This is E’s public key.” 39 Bob’s public key K B + Bob’s identifying information digital signature (encrypt) CA private key K CA - K B + certificate for Bob’s public key, signed by CA - K CA (K ) B +

 when Alice wants Bob’s public key: ◦ gets Bob’s certificate (Bob or elsewhere). ◦ apply CA’s public key to Bob’s certificate, get Bob’s public key 40 Bob’s public key K B + digital signature (decrypt) CA public key K CA + K B + - K (K ) B +

41  Serial number (unique to issuer)  info about certificate owner, including algorithm and key value itself (not shown) r info about certificate issuer r valid dates r digital signature by issuer

42